Section 889 Surveillance BOM: A Component-Level Checklist

The first is a system bill of materials: every camera, recorder, network device, radio, appliance, software platform, mobile app, cloud service, and material subcomponent identified by the manufacturer or integrator. The second is an entity and use map: the offeror, subsidiaries, service providers, manufacturers, distributors, and the places where covered equipment or services may be used.

Then test each row against the solicitation's Section 889 representation and prohibition language. Record the evidence, who supplied it, when it was checked, and any unresolved issue. A clean product list without the Part B entity inquiry is incomplete. A broad company representation without checking the proposed surveillance system is also incomplete.

This checklist supports supplier diligence; it does not determine legal compliance for every fact pattern. Contracting counsel or the contracting officer should resolve ambiguous coverage and disclosure questions.

Section 889 of the fiscal year 2019 National Defense Authorization Act created restrictions involving certain telecommunications and video-surveillance equipment and services.

Part A has applied since August 13, 2019. In practical terms, an executive agency may not procure or obtain, or extend or renew a contract to procure or obtain, equipment, a system, or a service that uses covered telecommunications equipment or services as a substantial or essential component or as critical technology.

Part B has applied since August 13, 2020. It restricts an executive agency from contracting with an entity that uses covered telecommunications equipment or services, subject to the governing rules and exceptions. The entity's use can matter even when the covered equipment is not part of the item being sold to the government.

The official acquisition.gov Section 889 page is the best starting point for current policy resources, FAQs, and waiver material. The operative decision must also consider the solicitation, current FAR text, agency deviations, and any agency-specific instruction.

The FAR definition names:

The definition and the “substantial or essential component” and “critical technology” tests matter. Procurement teams should resist two shortcuts: “the finished product has a different logo, so it is fine” and “one chip with a familiar name makes the entire system prohibited.” Either conclusion can skip the necessary facts.

Use a separate row for each orderable item and each material embedded or service component the manufacturer identifies. At minimum, capture the following.

Do not treat country of origin as a substitute for producer identity. A device assembled in one country can contain components and software from many sources. The reverse is also true: origin by itself does not establish that an item is covered.

Capture NVRs, DVRs, encoders, video gateways, analytics appliances, and any server image supplied with the solution. Identify motherboard or appliance OEM, capture-card manufacturer, storage controller, network interfaces, management software, and firmware.

These devices are easy to overlook when attention stays on the camera. They may be central to the system's operation and therefore deserve at least the same evidence quality.

List switches, routers, cellular gateways, wireless bridges, antennas with active electronics, modems, and out-of-band management devices. If an integrator says this equipment is “customer furnished,” assign ownership for screening instead of deleting it from the system view.

Record the video-management system, mobile application, analytics engine, device-discovery tool, remote-support platform, update service, and cloud storage or monitoring service. Include the legal entity providing each service and the hosting or subcontracting arrangement that the supplier discloses.

A camera can be acceptable as hardware while a proposed service creates a separate question. Conversely, a service name alone may obscure the device and network components used to deliver it.

Ordinary passive mounts and housings will rarely drive a Section 889 analysis, but active accessories can. Capture docking stations, communications modules, pan-tilt controllers, intercom modules, edge-compute boxes, and bundled wireless links. The useful boundary is not “expensive versus cheap”; it is whether the item supplies telecommunications, video-surveillance, or essential system functionality relevant to the rule.

“Clear” should mean the collected evidence supports the conclusion for the cited requirement—not that someone recognized the brand. “Escalate” is a valid interim answer. It is better than forcing uncertainty into a green cell.

Pull the Section 889 clauses, provisions, agency supplements, and proposal instructions from the current solicitation. Note the solicitation revision and amendment date. Do not rely only on an old compliance template: acquisition.gov warns users to follow current regulatory and agency material, and ongoing FAR changes can affect clause prescriptions and numbering.

Draw the system from lens to user. Include power and communications paths, recorders, management consoles, remote maintenance, cloud services, and mobile access. Identify government-furnished and reused components. A diagram often exposes missing BOM rows faster than a spreadsheet.

For each active product, ask whether the selling brand manufactured it, commissioned a private-label design, or rebrands another OEM's model. Request the OEM identity in writing. Compare FCC records, manuals, firmware portals, MAC address prefixes, product photographs, and other official records only as supporting checks; none of those alone proves Section 889 status.

If a supplier refuses to identify the actual manufacturer, record the refusal and escalate. An unsupported “NDAA compliant” badge does not close the information gap.

Check the current official definitions and any agency-provided excluded-party or covered-entity resources. Legal names matter because brands, subsidiaries, and corporate ownership change. Record the search date and the exact entity reviewed.

Do not make a definitive affiliate finding from a search-engine result. Route uncertain ownership through counsel or the contracting authority and ask the supplier to make a signed representation.

Describe what the questionable item does. Is it the camera, modem, radio, network gateway, or cloud service? Would the system perform its required mission without it? Does it handle communications or video surveillance? Is it critical technology as defined in the applicable rules?

This analysis is especially important for chipsets and embedded modules. The official Section 889 guide describes screening equipment, systems, and services and explains that the prohibition targets covered equipment used as a substantial or essential component or critical technology. It does not create a simple rule that every component from a named source produces the same result in every system. Ambiguous embedded-component questions deserve legal and contracting review, not an improvised bright line.

The FAR definition says a reasonable inquiry is designed to uncover information in the entity's possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity. It need not include an internal or third-party audit.

Set a scope that matches the entity and representation. Suggested questions include:

Keep the inquiry memorandum. Do not attach sensitive internal network details to a public proposal unless required; maintain them in the controlled compliance file.

Evidence strength generally improves in this order:

Even the strongest supplier packet does not replace the offeror's own representation. It gives the signer a better basis.

Add a purchase-order term requiring written notice before any manufacturer, OEM, hardware revision, radio, firmware branch, service provider, or country-of-origin change. Require rescreening before shipment. Low-stock substitutions are common in surveillance projects; the alternate should not inherit the original item's compliance file.

Check labels, model and revision, serial numbers, firmware, radio identifiers, and service endpoints against the approved BOM. Photograph labels when the program permits. Quarantine unexplained variances. Update the as-built BOM after commissioning so future Part B and maintenance reviews start with reality rather than the bid list.

Ask the manufacturer or integrator to respond to a numbered schedule:

Avoid asking for a single “NDAA certificate.” That phrase has no uniform evidentiary standard. A precise questionnaire creates comparable responses and makes omissions visible.

A useful retention packet explains not only the conclusion but how the buyer got there.